Key Disclosing in Multiphotons with Quantum Cloning 
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Multiphoton state in quantum cryptography decreases its security. Key disclosing with universal 
quantum cloning machine (UQCM) is considered in explicit manner. Although UQCM cannot make 
perfect clones, there is some invariant quantity between the original photon and the imperfect clones. 
The invariant quantity, the direction of Stokes parameters, tells us the auxiliary information leading 
into key information. The attack, then, corresponds to some kind of quantum non-demolition 
measurement. Its application to recent high-performance quantum cryptography, Y-00 protocol, is 
also studied. 
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I. INTRODUCTION 

Quantum cryptography 0,0 is expected to play an im- 
portant role in near future information security. Because 
its security is based on quantum mechanics instead of 
computational complexity and is absolutely proved in re- 
cent reports[!|-p|- Quantum cryptography in real world 
has, however, no perfect security, since it consists of im- 
perfect devices^. Almost reports0-^3 011 their exper- 
iments use weak coherent pulse and its pulse includes a 
little multiphoton. The multiphoton decreases its secu- 
rity. 

In this paper, we study how to disclose key infor- 
mation in multiphoton using universal quantum cloning 
machine(UQCM)[ll[l3 in explicit manner. No-cloning 
theorem[l4|, however, says that it is impossible to make 
perfect clones from unknown quantum state and any 
UQCM cannot make perfect clones. Imperfect clones 
do not tell us the exact information. Our strategy con- 
sists of three steps. The first step splits multiphoton into 
two identical (multi-)photons. The second step amplifies 
the split one to large number of imperfect clones with 
UQCM and measures them for 'auxiliary' information to 
be needed in the following correct observation. The third 
step observes the other split one correctly with the aux- 
iliary information and gets correct 'parity' information 
which equals to key information generally. The auxiliary 
information is, for example, a polarization base in the 
polarization coding and corresponds to the direction of 
Stokes parameters. The parity information, then, corre- 
sponds to 'up' and 'down.' Key point of our attack is 
that the imperfect clones with low fidelity keep the orig- 
inal direction exactly, although their parity information 
becomes obscure. Therefore we can measure accurately 
the direction of the Stokes parameters with large number 
of clones. 



Recently much higher performance quantum cryptog- 
raphy named "Y-00 protocol [TEj" with mesoscopic coher- 
ent pulse is reported0-[li|. Its bit rate is 1,000-10,000 
times higher than that of conventional quantum cryp- 
tography because its pulse has 100-1,000 photons. The 
proposers say that it has enough security by virtue of 
quantum noise, although its pulse has multiphoton. Its 
two key ingredients are multi-valued modulation related 
to the auxiliary information and 'ciphering wheel' which 
is a table of mapping from the parity and the auxiliary 
information to the key information. The attacker, Eve, 
knowing the correct parity information, gets wrong key 
information, if her auxiliary information differs from the 
correct one slightly. Disclosing the correct key informa- 
tion needs the accurate auxiliary information. We, then, 
apply our quantum amplification attack to Y-00 protocol. 

The outline of the paper is as follows. We define qubit 
and introduce its related quantities in Section II. Gisin 
and Massar's UQCM is introduced in Section III. Quan- 
tum amplification attack is described in section IV. The 
attack is applied to Y-00 protocol in section V. Finally 
we discuss physical background of the quantum amplifi- 
cation attack in section VI. 



II. QUBIT 



Qubit is generally defined by 
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on some basis, where \H) is horizontal linear polarized 
single photon state, |V) is vertical linear polarized single 
photon state, and < < ir, < <fi < 2ir. We focus on 
photon state as qubit in this paper. 

The photon state is represented as a point on Poincare 
sphere and is parameterized with Stokes parameters. 
Stokes parameters are macroscopically defined by 
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5*1 = Plh — Plv, 

5*2 = Pl+45 — Pl-4S, 

5*3 = Prhc — Plhc, 
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where P LH , Plv, Pl+45, Pl-45, Prhc, and P LH c are 
power of horizontal, vertical, +45 degree, -45 degree lin- 
ear and right-handed, left-handed circular polarized com- 
ponents of light. These definitions are microscopically 
equivalent to 
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Buzek and Hillery's UQCM making two clones of one 
qubit is, however, insufficient for our attack|20| and we 
use Gisin and Massar's generalized UQCMjTJ making 
g-identical clones of p-identical qubits (q > p). Given 
the p-identical input states UQCM makes g-clones 
in Fig. U] 



where an and ay are annihilation operators of horizon- 
tal and vertical linear polarized mode. These parame- 
ters are, then, equivalent to angular momentum opera- 
tors with the following commutation relations: 
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[Si, Sj] — UtijkSk 



(8) 



where e^fc is the totally antisymmetric Levi-Civita sym- 
bol and ei23 = 1. The commutation relations, thus, pre- 
vent all Stokes parameters from being measured simulta- 
neously and exactly. 

The photon state \tp) has the following density matrix: 
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FIG. 1: Gisin and Massar's UQCM 

Their density matrix has the following form: 

pout=Fp + Dp±, (17) 

where p± is the density matrix of the orthogonal state of 
\4>) and F is fidelity and D is disturbance. The fidelity 
and the disturbance satisfy the relation F + D = 1 . The 
orthogonal state with the following form: 



.cos-sin- e ^|^<ff|+sin 2 -|F}^|. 



(9) 



The expectation value of Stokes parameters are, then, 
calculated by 



(51) = Tr[Sip] = cos 9, 

(5 2 ) = Tr[S 2 p] = sin 9 cos, 

(53) = Tr[S3p] = sin#sin<; 

and their dispersions are given by 
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|^±>=sin-|fl}-cos-e*|V> 
has the diametrical Stokes parameters 
(Sj_i) = — cos 6*, 
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(13) factor is given by r\ 
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Therefore the direction of Stokes parameters is invari- 
ant in quantum cloning and its length is shrinking whose 



Measuring Stokes parameters on single photon, therefore, 
gains no sufficient large S/N ratio. 

The parity information is defined by the sign of S2 and 
the auxiliary information is defined by the quotient space 
of (9, 4>) which has the following equivalent class: 

(9,(j)) = (Tr-9,<p + ir). (16) 



III. UNIVERSAL QUANTUM CLONING 
MACHINE 



The concept of universal quantum clo ning machine 
(UQCM) is introduced by Buzek and Hiilery[l3| although 
No-cloning theorem prohibits perfect clones. UQCM, 
then, makes imperfect clones and 'universal' means that 
the quality of clone does not depend on an input state. 
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FIG. 2: Clone State 



then, decreases the parity information but conserves the 
auxiliary information. 
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Gisin and Massar give the following fidelity [l2j: 
= q(p+ 1) +P 

q(p + 2) 



(22) 



The result includes Buzek and Hillery's result at p = 1 
and g = 2. We, then, get the following disturbance: 
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and the shrinking factor is given by 

p(q + 2) 
g(p + 2) ' 



»7 



(23) 



(24) 



IV. QUANTUM AMPLIFICATION ATTACK 

We assume the targeted multiphoton can be divided 
into two (multi-) photons. The attack consists of two 
phases; the first one is measurement for the auxiliary 
information using the divided (multi-) photon and the 
second one is observation for the parity information us- 
ing the other divided (multi-) photon. The first phase is 
divided into two steps; Step 1 is quantum amplification 
of the former (multi-) photon and Step 2 is measurement 
of the quantum amplified photons for the auxiliary infor- 
mation. The whole attack, then, consists of three steps 
in Fig. 
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FIG. 3: Quantum Amplification Attack 



A. Quantum amplification 

Eve makes Gisin and Massar's UQCM work in L-stcps 
cascade manner and propagates the imperfect clones to 
(q/p) L -photons. Assuming that the density matrix in the 
k-step is given by 

Pk = a k p + b k p ±1 (25) 
the coefficients a k and b k obey the following recurrences: 



a k+1 = Fa k + Db k 



b k+ i = Da k + Fb k , 



(26) 



(27) 



from (|17|l . Solving the recurrences, we get the following 
final state: 

P^ = \^ + V L )p+\^-r] L )px- (28) 

The final state is much depolarized and its parity infor- 
mation cannot be gained, if L is large enough . 



B. Measurement for the auxiliary information 

Eve measures Stokes parameters of the (q/p) L -clones 
though the states are much depolarized. The expecta- 
tion values of Stokes parameters per single photon are 
calculated by 
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and their dispersions are given by 
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The whole Stokes parameters and the whole dispersions 
are proportional to the total photon number (q/p) L . The 
whole Stokes parameters are obtained by 
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Their S/N ratio is also estimated by 

(q/p) L (s*) „ 



S/N 



(q/p) L / 2 AS* 



v L = 



P(g + 2) s 
q(p + 2Y 
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and then the S/N ratio grows large if the index satisfies 
the inequality 



p{q + 2f 



> 1. 
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The growing condition is as follows: 
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and its solution becomes 

g>4atp = l, or q>p>2. 



(39) 



(40) 



(41) 



Therefore the whole Stokes parameters grow large enough 
to be measured accurately if L is sufficiently large and the 
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inequality (|41|l is satisfied. Buzek and Hillery's UQCM 
does not satisfy the condition and cannot be used in the 
attack 20]. Eve, then, measures the Stokes parameters 
and gets the accurate auxiliary information. 

We can also estimate statistical S/N ratio although the 
S/N ratio by quantum noise has been estimated in the 
above argument. The final states are (<7/p) L -identical 
states obeying binominal distribution 



P(k) = N C k F final N - k D R 



nal 



(42) 



where P(k) is probability distribution function with the 
N — fc-original state p and the fc-orthogonal state p±, 
N = (q/p) L , F final = (l + 77 L )/2, D final = (l-r? L )/2, and 
ArCfc is binominal coefficient. The mean value of Stokes 
parameter is, then, calculated by 



(S 
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Its variance is given by 

(ASf) statistics /statistics v^l/ statistics' 

= 4Ffi nal L> final iV cos 2 9. 
Therefore the statistical S/N ratio is obtained by 



(43) 
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The result is the same as (|38[) in the quantum noise. 

C. Observation for the parity information 

Eve observes the latter (multi-)photon with the auxil- 
iary information obtained in step 2 and gets the correct 
parity information. The parity information is equivalent 
to key information generally and she obtains the correct 
key information. 

The attack enables Eve to disclose key information be- 
fore the auxiliary information is opened by the legitimate 
entities and is effective for some protocols with multi- 
photon having no public announcement of the auxiliary 
information [ 

V. APPLICATION TO Y-00 PROTOCOL 

Recently reported Y-00 protocol |l5 | - [l9 | is a kind of 
quantum key expansion protocol and 1,000-10,000 times 



faster than conventional quantum cryptography because 
it uses mesoscopic coherent pulse including 100-1,000 
photons. The quantum amplification attack seems to be 
applicable to Y-00 protocol whose security depends on 
quantum noise with two important ingredients: multi- 
valued modulation and ciphering wheel. 



A. Essence of Y-00 protocol 

We roughly sketch the essence of Y-00 protocol with 
polarization coding in the following. Y-00 protocol pre- 
pares the M-pair states: 
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(47) 



where k — 0, . . . , M — 1 and the right-sided ket vector 



is coherent state on each basis and 



equals to the 



average photon number and 9^ — irk/M . The two pairing 
states have the diametrical relation with each other on 
Poincare sphere. The sign in the left side corresponds to 
the parity information and the multi-valued k in the left 
side corresponds to the auxiliary information. 

Key information is not the same as the parity informa- 
tion in Y-00 protocol. The ciphering wheel maps from 
the parity information and the auxiliary information to 
the key information in the following: 



CW(+, k : even) = 0, 

CW(-,k: even) = 1, 

CW{+,k : odd) = 1, 

CW{-,k : odd) = 0. 



(48) 
(49) 
(50) 
(51) 



Eve without knowing the auxiliary information, thus, 
cannot guess the correct key information even though 
she knows the correct parity information. 

The state |+, k) has the following Stokes parameters: 



{Si) 
(S 2 ) 
(Ss) 



\a\ 2 cos( 



lal 2 sin( 



0. 



and their dispersions are given by 
AS 2 



AS 2 



(52) 
(53) 
(54) 

(55) 



The neighboring states with the same parity cannot be 
discriminated if M is sufficiently large, where the neigh- 
boring condition is given by 



\S±, k -S±, k ,\ < AS=\a\. 
The condition is equivalent to 



Afc < 



(56) 



(57) 



and Y-00 protocol seems to be secure if M > \a\ir is 
satisfied. 
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B. Quantum Amplification Attack to Y-00 protocol 

The quantum amplification attack needs no auxiliary 
information opened publicly and then seems to be effec- 
tive against Y-00 protocol. It uses mesoscopic coherent 
pulse instead of single photon state. Eve must extract 
some single photon states from the mesoscopic coherent 
state in order to let the UQCM work. 

She splits the targeted state into two mesoscopic co- 
herent state by a beam splitter at first. The one state 
|ai cos9/2)h \ol\ sin 0/2) y is used in the quantum ampli- 
fication and measurement for the auxiliary information. 

The other state \a% cos 0/2) h |«2 sin 9/2)y is used in 
measurement for the parity information. 

Eve, moreover, splits the first state into J-weak coher- 
ent states by beam splitters in a cascade way 



ax 0\ 

—F= COS - ) 



a x . 0\ 
VJ 2/, 



(58) 



where \ot\\ 2 / J <C I. 

One of the weak coherent states is equivalent to 



|0> h |0>v+^(cob||1>h| 



sm-| 



I) 



+0(Lj-), (59) 



where |0), |I) are numbering states in each mode. The 
first term is a vacuum and the second is single photon 
state. Other multiphoton states are negligible. 
The single photon state can be represented by 



^(co S 9 -\H) +S xn d -\V) 



(60) 



in qubit-like representation. Eve expects to get |o;i| 2 - 
identical single photons because she has J-states. The 
state, moreover, keeps the auxiliary information per- 
fectly. 

Eve quantum-amplifies the obtained single photon 
states and measures them for the accurate auxiliary in- 
formation. She obtains the correct parity information 
using the auxiliary information finally. 



VI. DISCUSSION 

In the quantum amplification attack, the UQCM plays 
an important role though any UQCM cannot make per- 
fect clones. Because the UQCM, which is some kind 
of unitary transformation, has invariant subspace in the 
space of Stokes parameters R 3 . Although the fidelity of 
an imperfect clone to the original photon decreases below 
1, the direction of its Stokes parameters is invariant be- 
tween the original and the clone. The space of Stokes pa- 
rameters is, then, divided by one-dimensional real space 
and two-dimensional projective space, 



where the parity information corresponds to the sign of 
the one-dimensional real space R and the auxiliary in- 
formation corresponds to the two-dimensional projective 
space P 2 which is invariant under the transformation by 
the UQCM. 

The commutation relations (jSJ) among Stokes param- 
eters say that the all parameters cannot be observed si- 
multaneously and accurately by uncertainty relations. It, 
then, seems strange that the attack measures the accu- 
rate direction of the Stokes parameters. The accurate 
measurement, however, does not contradict the uncer- 
tainty relations because the attack gains no parity in- 
formation and then two diametrical points on Poincare 
sphere cannot be discriminated. The attack, then, 
squeezes any state to extending to the parity real space 
and to shrinking in the projective space in Fig. There- 
fore the attack may be regarded as some kind of quantum 
non-demolition measurement I231 . 




at = 



FIG. 4: Squeezing 
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The attack is applicable to BB84 protocol with mul- 
tiphoton although it does not work in the protocol with 
single photon because the protocol carries critical infor- 
mation on the parity information. On the other hand, 
the attack is also expected to be effective in Y-00 pro- 
tocol because the protocol carries critical information on 
the auxiliary information rather than the parity informa- 
tion. 

The attack has, however, some open problems. It is 
generally said that no photon-number amplifier can avoid 
fluctuation of photon-number and then sufficient large 
S/N ratio cannot be gained ppf. The UQCM is, however, 
a kind of unitary transformation and the photon-number 
is conserved. It, then, seems to be hard for the UQCM 
to exist. It is more severe problem that the measurement 
of Strokes parameters is executed to the whole clones 
and the treatment as the mixed states is somewhat won- 
dered since the output state of the UQCM is entangled 
state and independent measurement changes the entan- 
gled output into the mixed states. The cascade manner 
operation of the UQCM is not a severe problem because 
the attack is effective at L = 1. Its application to B92 
protocol|23( whose critical information is also carried on 
the auxiliary information would be challenging because 
recent reports[3ll3 have proved its unconditional secu- 
rity. 
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